@telorun/analyzer 0.12.0 → 0.12.1

package/README.md

@@ -61,12 +61,12 @@ targets:
 kind: Telo.Import
 metadata:
   name: Http
-source: std/http-server@0.4.0
+source: std/http-server@0.5.0
 ---
 kind: Telo.Import
 metadata:
   name: Sql
-source: std/sql@0.2.3
+source: std/sql@0.3.0
 ---
 # SQLite database — swap driver/host/database for PostgreSQL with zero YAML changes
 kind: Sql.Connection

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAgB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAgf/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IA8dvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAexF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAgB9B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAif/F,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,OAAO,GAAE,qBAA0B;IAI/C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAoiBvB,aAAa,CACX,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,kBAAkB,EAAE;IAMvB,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,EAAE;IAexF,OAAO,CACL,SAAS,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB;QAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAsB5F"}

package/dist/analyzer.js

@@ -14,6 +14,7 @@ import { celTypeSatisfiesJsonSchema, substituteCelFields, validateAgainstSchema,
 import { DiagnosticSeverity } from "./types.js";
 import { getManifestItem, pathMatchesScope, resolveContextAnnotations, resolveTypeFieldToSchema, } from "./validate-cel-context.js";
 import { validateExtends } from "./validate-extends.js";
+import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
 import { validateReferences } from "./validate-references.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
@@ -563,6 +564,34 @@ export class StaticAnalyzer {
                 byName.set(m.metadata.name, m);
             }
         }
+        // Fail loud on definition schemas AJV cannot compile. `validateAgainstSchema`
+        // and `validateWithRefs` swallow compile failures (returning no issues),
+        // which would silently skip schema validation for every resource of that
+        // kind — surface the broken schema once, anchored on the definition itself.
+        for (const m of allManifests) {
+            if (m.kind !== "Telo.Definition" && m.kind !== "Telo.Abstract")
+                continue;
+            const schema = m.schema;
+            if (!schema || typeof schema !== "object")
+                continue;
+            const name = m.metadata?.name;
+            if (!name)
+                continue;
+            const compileError = defs.schemaCompileError(schema);
+            if (compileError) {
+                diagnostics.push({
+                    severity: DiagnosticSeverity.Error,
+                    code: "SCHEMA_COMPILE_ERROR",
+                    source: SOURCE,
+                    message: `${m.kind}/${name}: definition schema failed to compile: ${compileError}`,
+                    data: {
+                        resource: { kind: m.kind, name },
+                        filePath: m.metadata?.source,
+                        path: "schema",
+                    },
+                });
+            }
+        }
         // Library env: rejection — `env:` on a Library `variables` / `secrets`
         // entry is forbidden. The Library entry schema is otherwise open so that
         // any JSON Schema property schema is valid; this targeted check produces
@@ -664,6 +693,33 @@ export class StaticAnalyzer {
                     });
                 }
             }
+            // Validate inline resources nested inside this resource's body (e.g. a
+            // Run.Sequence step's `invoke: { kind, ...config }`). These sit at
+            // x-telo-ref slots reached only through local `$ref`s, which the
+            // reference field map intentionally does not follow, so they escape both
+            // inline-extraction and the per-resource schema check above.
+            if (definition.schema) {
+                // Resolve inline kinds in the parent resource's scope: direct kind
+                // first, then the parent module's own aliases (for resources declared
+                // inside an imported module), then the root aliases. Mirrors how the
+                // analyzer resolves kinds elsewhere so module-scoped aliases don't
+                // produce false UNDEFINED_KIND diagnostics.
+                const ownModule = m.metadata?.module;
+                const scopeResolver = ownModule && !rootModules.has(ownModule) ? aliasesByModule.get(ownModule) : undefined;
+                diagnostics.push(...validateNestedInlineResources(m, definition.schema, (kind) => {
+                    const direct = defs.resolve(kind);
+                    if (direct)
+                        return direct;
+                    const viaScope = scopeResolver?.resolveKind(kind);
+                    if (viaScope) {
+                        const scoped = defs.resolve(viaScope);
+                        if (scoped)
+                            return scoped;
+                    }
+                    const viaRoot = aliases.resolveKind(kind);
+                    return viaRoot ? defs.resolve(viaRoot) : undefined;
+                }));
+            }
             // (Invocation context compatibility check is handled via x-telo-context in the CEL pass below)
         }
         // Template-body structural validations: check that template entry-points produce
@@ -789,8 +845,18 @@ export class StaticAnalyzer {
                     effectiveContext = mergeKernelGlobalsIntoContext(resolvedContext, kernelGlobals);
                 }
                 const engine = defaultRegistry().get(engineName);
-                if (!engine)
+                if (!engine) {
+                    // No registered engine owns this tag — the expression would go
+                    // entirely unanalyzed. Surface it rather than skipping silently.
+                    diagnostics.push({
+                        severity: DiagnosticSeverity.Error,
+                        code: "UNKNOWN_ENGINE",
+                        source: SOURCE,
+                        message: `${m.kind}/${resource.name}: no templating engine registered for '!${engineName}' at '${path}'.`,
+                        data: { resource, filePath, path },
+                    });
                     return;
+                }
                 const findings = engine.analyze(expr, { celEnv: this.celEnv, contextSchema: effectiveContext });
                 for (const f of findings) {
                     if (f.code === "CEL_SYNTAX_ERROR") {

package/dist/definition-registry.d.ts

@@ -31,8 +31,19 @@ export declare class DefinitionRegistry {
      *  Returns undefined when the module identity is not yet registered. */
     computeId(moduleName: string, typeName: string): string | undefined;
     /** Validates data against a schema using this registry's AJV instance, which has all
-     *  registered definition schemas loaded — enabling cross-module $ref resolution. */
+     *  registered definition schemas loaded — enabling cross-module $ref resolution.
+     *  A compile failure returns `[]` here; it is surfaced loudly (once, on the
+     *  owning definition) by `schemaCompileError` via the analyzer's
+     *  definition-schema compile check, so resources are never silently skipped. */
     validateWithRefs(data: unknown, schema: Record<string, any>): string[];
+    /** Returns the AJV compile error for `schema`, or `undefined` when it compiles.
+     *  Compiles on this registry's instance, which has every loaded module schema
+     *  plus the manifest root registered, so local `#/$defs`, `telo://manifest`,
+     *  and cross-module `$ref`s all resolve. Used to fail loud on a definition
+     *  schema that AJV cannot compile — otherwise `validateAgainstSchema` /
+     *  `validateWithRefs` would swallow the failure and silently skip every
+     *  resource of that kind. */
+    schemaCompileError(schema: Record<string, any>): string | undefined;
     private tryRegisterSchema;
     /** Resolves an x-telo-ref string to a canonical registry kind key.
      *  Splits on "#", looks up the left side in the identity table, and returns

package/dist/definition-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;6DACyD;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD;;0EAEsE;IACtE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAEhE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAiC9C,OAAO,CAAC,aAAa;IASrB;;;yFAGqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IA+B1E;4EACwE;IACxE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMnE;wFACoF;IACpF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;4FAQwF;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAUhD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD,+FAA+F;IAC/F,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAuBhC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}
+{"version":3,"file":"definition-registry.d.ts","sourceRoot":"","sources":["../src/definition-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,+EAA+E;AAC/E,qBAAa,kBAAkB;;IAK7B;;sFAEkF;IAClF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D;6DACyD;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD;;0EAEsE;IACtE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAEhE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAiC9C,OAAO,CAAC,aAAa;IASrB;;;yFAGqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IA+B1E;4EACwE;IACxE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMnE;;;;oFAIgF;IAChF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE;IAWtE;;;;;;iCAM6B;IAC7B,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IASnE,OAAO,CAAC,iBAAiB;IAczB;;;;;;;;4FAQwF;IACxF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAUhD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrD,+FAA+F;IAC/F,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIxD,gGAAgG;IAChG,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,GACvD,iBAAiB,GAAG,SAAS;IAOhC;;;;;;;;qFAQiF;IACjF,2BAA2B,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,iBAAiB,GAAG,SAAS;IAuBhC,OAAO,CAAC,uBAAuB;IA+B/B;;qEAEiE;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAgBxD,KAAK,IAAI,MAAM,EAAE;CAGlB"}

package/dist/definition-registry.js

@@ -105,7 +105,10 @@ export class DefinitionRegistry {
         return `${identity}/${typeName}`;
     }
     /** Validates data against a schema using this registry's AJV instance, which has all
-     *  registered definition schemas loaded — enabling cross-module $ref resolution. */
+     *  registered definition schemas loaded — enabling cross-module $ref resolution.
+     *  A compile failure returns `[]` here; it is surfaced loudly (once, on the
+     *  owning definition) by `schemaCompileError` via the analyzer's
+     *  definition-schema compile check, so resources are never silently skipped. */
     validateWithRefs(data, schema) {
         let validate;
         try {
@@ -118,6 +121,22 @@ export class DefinitionRegistry {
             return [];
         return (validate.errors ?? []).map(formatSingleError);
     }
+    /** Returns the AJV compile error for `schema`, or `undefined` when it compiles.
+     *  Compiles on this registry's instance, which has every loaded module schema
+     *  plus the manifest root registered, so local `#/$defs`, `telo://manifest`,
+     *  and cross-module `$ref`s all resolve. Used to fail loud on a definition
+     *  schema that AJV cannot compile — otherwise `validateAgainstSchema` /
+     *  `validateWithRefs` would swallow the failure and silently skip every
+     *  resource of that kind. */
+    schemaCompileError(schema) {
+        try {
+            this.ajv.compile(schema);
+            return undefined;
+        }
+        catch (err) {
+            return err instanceof Error ? err.message : String(err);
+        }
+    }
     tryRegisterSchema(moduleName, typeName, schema) {
         const id = this.computeId(moduleName, typeName);
         if (!id || this.registeredSchemaIds.has(id))

package/dist/reference-field-map.d.ts

@@ -78,6 +78,7 @@ export declare function resolveFieldValues(obj: unknown, path: string): unknown[
  * - A node with `properties` → recurse into each property
  */
 export declare function buildReferenceFieldMap(schema: Record<string, any>): ReferenceFieldMap;
+export declare function collectRefs(node: Record<string, any>): string[];
 /** Traverses an arbitrary JSON Schema starting at the given path prefix. Used to
  *  expand x-telo-schema-from sub-schemas into nested ref/scope entries so Phase 2
  *  inline normalization and Phase 5 injection see slots that the local field map

package/dist/reference-field-map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reference-field-map.d.ts","sourceRoot":"","sources":["../src/reference-field-map.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B;sDACkD;IAClD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0FAA0F;IAC1F,OAAO,EAAE,OAAO,CAAC;IACjB;8DAC0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC/B;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B;2CACuC;IACvC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED;8CAC8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC;;qFAEiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAEnF;0FAC0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,aAAa,CAEvE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,eAAe,CAE3E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,oBAAoB,CAErF;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,aAAwC,CAAC;AAEpE;;;;;;;;;2EAS2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAItE;AAED;;;;sEAIsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;wDAUwD;AACxD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAoCpF;AAED;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAExE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,iBAAiB,CAQrF;AAiBD;;;8CAG8C;AAC9C,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,iBAAiB,CAInB"}
+{"version":3,"file":"reference-field-map.d.ts","sourceRoot":"","sources":["../src/reference-field-map.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B;sDACkD;IAClD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0FAA0F;IAC1F,OAAO,EAAE,OAAO,CAAC;IACjB;8DAC0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC/B;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B;2CACuC;IACvC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED;8CAC8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC;;qFAEiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAEnF;0FAC0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,aAAa,CAEvE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,eAAe,CAE3E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,oBAAoB,CAErF;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,aAAwC,CAAC;AAEpE;;;;;;;;;2EAS2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAItE;AAED;;;;sEAIsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;wDAUwD;AACxD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAoCpF;AAED;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAExE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,iBAAiB,CAQrF;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAa/D;AAED;;;8CAG8C;AAC9C,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,iBAAiB,CAInB"}

package/dist/reference-field-map.js

@@ -103,7 +103,7 @@ export function buildReferenceFieldMap(schema) {
     }
     return map;
 }
-function collectRefs(node) {
+export function collectRefs(node) {
     const refs = [];
     if (typeof node["x-telo-ref"] === "string") {
         refs.push(node["x-telo-ref"]);

package/dist/schema-compat.d.ts

@@ -41,6 +41,10 @@ export declare function jsonSchemaToCelType(schema: Record<string, any> | undefi
 export declare function celTypeSatisfiesJsonSchema(celType: string, schema: Record<string, any>): boolean;
 /** Return a literal placeholder value of the correct schema type for AJV. */
 export declare function celPlaceholderForSchema(schema: Record<string, any>): unknown;
+/** Resolve a `$ref` (only `#/$defs/...` form) against the root schema. */
+export declare function resolveRef(schema: Record<string, any>, root: Record<string, any>): Record<string, any>;
+/** Collect property schemas from top-level `properties` and all `oneOf`/`anyOf` sub-schemas. */
+export declare function collectProperties(schema: Record<string, any>): Record<string, any>;
 /** Deep-clone `data`, replacing every pure CEL template string (`${{ expr }}`) with a
  *  schema-appropriate placeholder so AJV can validate non-CEL fields without false positives. */
 export declare function substituteCelFields(data: unknown, schema: Record<string, any>, rootSchema?: Record<string, any>): unknown;

package/dist/schema-compat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAOpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;oEAEoE;AACpE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,mBAAmB,CAIrB;AAiDD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CAe/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAuBnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAqBhG;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiB5E;AA2BD;iGACiG;AACjG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC/B,OAAO,CAqCT"}
+{"version":3,"file":"schema-compat.d.ts","sourceRoot":"","sources":["../src/schema-compat.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,GAAG,KAA0C,CAAC;AAEpD;;;;;;;mCAOmC;AACnC,wBAAgB,SAAS,IAAI,YAAY,CAAC,OAAO,GAAG,CAAC,CAOpD;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;oEAEoE;AACpE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,mBAAmB,CAIrB;AAiDD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGxE;AAuBD,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,WAAW,EAAE,CAmB/F;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;;6DAI6D;AAC7D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAsBjC;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,MAAM,CAuBnF;AAED,wFAAwF;AACxF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAqBhG;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAiB5E;AAID,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOtG;AAED,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAUlF;AAED;iGACiG;AACjG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC/B,OAAO,CAqCT"}

package/dist/schema-compat.js

@@ -109,6 +109,10 @@ export function validateAgainstSchema(data, schema) {
             compiledSchemaValidators.set(schema, validate);
         }
         catch {
+            // A schema that won't compile is reported loudly (once, on the owning
+            // definition) by the analyzer's definition-schema compile check
+            // (`DefinitionRegistry.schemaCompileError`), so returning `[]` here does
+            // not silently accept resources of that kind.
             return [];
         }
     }
@@ -247,7 +251,7 @@ export function celPlaceholderForSchema(schema) {
 }
 const CEL_PURE_RE = /^\s*\$\{\{[^}]*\}\}\s*$/;
 /** Resolve a `$ref` (only `#/$defs/...` form) against the root schema. */
-function resolveRef(schema, root) {
+export function resolveRef(schema, root) {
     if (schema.$ref && typeof schema.$ref === "string" && schema.$ref.startsWith("#/$defs/")) {
         const defName = schema.$ref.slice("#/$defs/".length);
         const resolved = root.$defs?.[defName];
@@ -257,7 +261,7 @@ function resolveRef(schema, root) {
     return schema;
 }
 /** Collect property schemas from top-level `properties` and all `oneOf`/`anyOf` sub-schemas. */
-function collectProperties(schema) {
+export function collectProperties(schema) {
     const props = { ...(schema.properties ?? {}) };
     for (const sub of schema.oneOf ?? schema.anyOf ?? []) {
         if (sub && typeof sub === "object" && sub.properties) {

package/dist/validate-nested-inline.d.ts

@@ -0,0 +1,30 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import { type AnalysisDiagnostic } from "./types.js";
+/** Minimal view of a definition needed to validate an inline resource's config. */
+export interface InlineDefinitionLookup {
+    (kind: string): {
+        schema?: Record<string, any>;
+    } | undefined;
+}
+/**
+ * Validates inline resources nested inside a resource body against their kind's
+ * config schema. The per-resource walk in `analyze()` validates a resource's
+ * own top-level config; inline resources at `x-telo-ref` slots reachable only
+ * through a local `$ref` (notably `Run.Sequence`'s `steps[].invoke`, hidden
+ * behind `#/$defs/step`) never reach the reference field map, so they would
+ * otherwise escape schema validation — e.g. `invoke: { kind: Console.ReadLine,
+ * prompt: "…" }`, where `prompt` belongs in the step's `inputs`, not the config.
+ *
+ * Walks the manifest data together with its definition schema, resolving local
+ * `$ref`s (so step trees of arbitrary depth are covered). At each `x-telo-ref`
+ * slot holding an inline resource, the inline's config is validated against its
+ * own kind's schema, then recursed into so inline resources nested inside
+ * inline resources are covered.
+ *
+ * Non-mutating: reads `manifest` and emits diagnostics anchored to its identity
+ * and a concrete dotted path matching the position-index key format;
+ * `rewriteSyntheticOrigins` reroutes those on inline-extracted (synthetic)
+ * manifests back to the root doc.
+ */
+export declare function validateNestedInlineResources(manifest: ResourceManifest, rootSchema: Record<string, any>, lookupDefinition: InlineDefinitionLookup): AnalysisDiagnostic[];
+//# sourceMappingURL=validate-nested-inline.d.ts.map

package/dist/validate-nested-inline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-nested-inline.d.ts","sourceRoot":"","sources":["../src/validate-nested-inline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAQrD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIzE,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,gBAAgB,EAAE,sBAAsB,GACvC,kBAAkB,EAAE,CAoHtB"}

package/dist/validate-nested-inline.js

@@ -0,0 +1,129 @@
+import { collectRefs, isInlineResource } from "./reference-field-map.js";
+import { collectProperties, resolveRef, substituteCelFields, validateAgainstSchema, } from "./schema-compat.js";
+import { DiagnosticSeverity } from "./types.js";
+const SOURCE = "telo-analyzer";
+/**
+ * Validates inline resources nested inside a resource body against their kind's
+ * config schema. The per-resource walk in `analyze()` validates a resource's
+ * own top-level config; inline resources at `x-telo-ref` slots reachable only
+ * through a local `$ref` (notably `Run.Sequence`'s `steps[].invoke`, hidden
+ * behind `#/$defs/step`) never reach the reference field map, so they would
+ * otherwise escape schema validation — e.g. `invoke: { kind: Console.ReadLine,
+ * prompt: "…" }`, where `prompt` belongs in the step's `inputs`, not the config.
+ *
+ * Walks the manifest data together with its definition schema, resolving local
+ * `$ref`s (so step trees of arbitrary depth are covered). At each `x-telo-ref`
+ * slot holding an inline resource, the inline's config is validated against its
+ * own kind's schema, then recursed into so inline resources nested inside
+ * inline resources are covered.
+ *
+ * Non-mutating: reads `manifest` and emits diagnostics anchored to its identity
+ * and a concrete dotted path matching the position-index key format;
+ * `rewriteSyntheticOrigins` reroutes those on inline-extracted (synthetic)
+ * manifests back to the root doc.
+ */
+export function validateNestedInlineResources(manifest, rootSchema, lookupDefinition) {
+    const diagnostics = [];
+    const resource = { kind: manifest.kind, name: manifest.metadata?.name };
+    const filePath = manifest.metadata?.source;
+    function validateInline(inline, path) {
+        const kind = inline.kind;
+        const def = lookupDefinition(kind);
+        // Unknown kind: these `$ref`-hidden slots are invisible to the field-map
+        // driven reference checks too, so nothing else would flag it — report here.
+        if (!def) {
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "UNDEFINED_KIND",
+                source: SOURCE,
+                message: `${resource.kind}/${resource.name}: inline ${kind} at '${path}': No Telo.Definition found for kind '${kind}'.`,
+                data: { resource, filePath, path: `${path}.kind` },
+            });
+            return;
+        }
+        // Kind exists but declares no config schema (e.g. a pure Telo.Type): no
+        // config to validate and no schema-declared slots to nest resources in.
+        if (!def.schema)
+            return;
+        const schema = def.schema;
+        // `kind` / `metadata` are implicit on every resource; inject them so a
+        // strict `additionalProperties: false` config schema doesn't reject them.
+        const effectiveSchema = schema.additionalProperties === false
+            ? {
+                ...schema,
+                properties: {
+                    kind: { type: "string" },
+                    metadata: { type: "object" },
+                    ...schema.properties,
+                },
+            }
+            : schema;
+        // Inline resources omit `metadata` — it is synthesized when the kernel
+        // registers them (and by `normalizeInlineResources` for extracted slots,
+        // which assigns a derived `metadata.name`). Config schemas conventionally
+        // declare `required: ["metadata", …]` with `metadata.name` required, so add
+        // a placeholder before validating to mirror the post-registration shape.
+        const existingMeta = inline.metadata && typeof inline.metadata === "object"
+            ? inline.metadata
+            : {};
+        const data = { ...inline, metadata: { name: "__inline__", ...existingMeta } };
+        const substituted = substituteCelFields(data, effectiveSchema, effectiveSchema);
+        for (const issue of validateAgainstSchema(substituted, effectiveSchema)) {
+            diagnostics.push({
+                severity: DiagnosticSeverity.Error,
+                code: "SCHEMA_VIOLATION",
+                source: SOURCE,
+                message: `${resource.kind}/${resource.name}: inline ${kind} at '${path}': ${issue.message}`,
+                data: { resource, filePath, path: issue.path ? `${path}.${issue.path}` : path },
+            });
+        }
+        // Recurse into the inline body against its own schema so deeper inline
+        // resources (e.g. an inline Run.Sequence's own steps) are validated too.
+        walk(inline, schema, schema, path);
+    }
+    function walk(data, schema, schemaRoot, path) {
+        if (!schema || typeof schema !== "object")
+            return;
+        const resolved = resolveRef(schema, schemaRoot);
+        // Reference slot: the value is either a named reference (`{kind, name}`,
+        // validated as its own manifest) or an inline resource to validate here.
+        if (collectRefs(resolved).length > 0) {
+            if (data &&
+                typeof data === "object" &&
+                !Array.isArray(data) &&
+                isInlineResource(data)) {
+                validateInline(data, path);
+            }
+            return;
+        }
+        if (Array.isArray(data)) {
+            const itemSchema = resolved.items;
+            if (!itemSchema)
+                return;
+            for (let i = 0; i < data.length; i++) {
+                walk(data[i], itemSchema, schemaRoot, `${path}[${i}]`);
+            }
+            return;
+        }
+        if (data && typeof data === "object") {
+            const props = collectProperties(resolved);
+            const additional = resolved.additionalProperties &&
+                typeof resolved.additionalProperties === "object" &&
+                !Array.isArray(resolved.additionalProperties)
+                ? resolved.additionalProperties
+                : undefined;
+            // Descend only where the schema declares structure. Freeform fields
+            // (`additionalProperties: true`, e.g. step `inputs`) carry caller data
+            // that may coincidentally look like `{kind: …}`; not descending there
+            // keeps the inline-resource detection anchored to real ref slots.
+            for (const [key, value] of Object.entries(data)) {
+                const propSchema = props[key] ?? additional;
+                if (!propSchema)
+                    continue;
+                walk(value, propSchema, schemaRoot, path ? `${path}.${key}` : key);
+            }
+        }
+    }
+    walk(manifest, rootSchema, rootSchema, "");
+    return diagnostics;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",

package/src/analyzer.ts

@@ -31,6 +31,7 @@ import {
   resolveTypeFieldToSchema,
 } from "./validate-cel-context.js";
 import { validateExtends } from "./validate-extends.js";
+import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
 import { validateReferences } from "./validate-references.js";
 import { validateThrowsCoverage } from "./validate-throws-coverage.js";
@@ -698,6 +699,32 @@ export class StaticAnalyzer {
       }
     }
 
+    // Fail loud on definition schemas AJV cannot compile. `validateAgainstSchema`
+    // and `validateWithRefs` swallow compile failures (returning no issues),
+    // which would silently skip schema validation for every resource of that
+    // kind — surface the broken schema once, anchored on the definition itself.
+    for (const m of allManifests) {
+      if (m.kind !== "Telo.Definition" && m.kind !== "Telo.Abstract") continue;
+      const schema = (m as Record<string, any>).schema;
+      if (!schema || typeof schema !== "object") continue;
+      const name = m.metadata?.name as string | undefined;
+      if (!name) continue;
+      const compileError = defs.schemaCompileError(schema as Record<string, any>);
+      if (compileError) {
+        diagnostics.push({
+          severity: DiagnosticSeverity.Error,
+          code: "SCHEMA_COMPILE_ERROR",
+          source: SOURCE,
+          message: `${m.kind}/${name}: definition schema failed to compile: ${compileError}`,
+          data: {
+            resource: { kind: m.kind, name },
+            filePath: (m.metadata as { source?: string } | undefined)?.source,
+            path: "schema",
+          },
+        });
+      }
+    }
+
     // Library env: rejection — `env:` on a Library `variables` / `secrets`
     // entry is forbidden. The Library entry schema is otherwise open so that
     // any JSON Schema property schema is valid; this targeted check produces
@@ -805,6 +832,39 @@ export class StaticAnalyzer {
         }
       }
 
+      // Validate inline resources nested inside this resource's body (e.g. a
+      // Run.Sequence step's `invoke: { kind, ...config }`). These sit at
+      // x-telo-ref slots reached only through local `$ref`s, which the
+      // reference field map intentionally does not follow, so they escape both
+      // inline-extraction and the per-resource schema check above.
+      if (definition.schema) {
+        // Resolve inline kinds in the parent resource's scope: direct kind
+        // first, then the parent module's own aliases (for resources declared
+        // inside an imported module), then the root aliases. Mirrors how the
+        // analyzer resolves kinds elsewhere so module-scoped aliases don't
+        // produce false UNDEFINED_KIND diagnostics.
+        const ownModule = (m.metadata as { module?: string } | undefined)?.module;
+        const scopeResolver =
+          ownModule && !rootModules.has(ownModule) ? aliasesByModule.get(ownModule) : undefined;
+        diagnostics.push(
+          ...validateNestedInlineResources(
+            m,
+            definition.schema as Record<string, any>,
+            (kind: string) => {
+              const direct = defs.resolve(kind);
+              if (direct) return direct;
+              const viaScope = scopeResolver?.resolveKind(kind);
+              if (viaScope) {
+                const scoped = defs.resolve(viaScope);
+                if (scoped) return scoped;
+              }
+              const viaRoot = aliases.resolveKind(kind);
+              return viaRoot ? defs.resolve(viaRoot) : undefined;
+            },
+          ),
+        );
+      }
+
       // (Invocation context compatibility check is handled via x-telo-context in the CEL pass below)
     }
 
@@ -973,7 +1033,18 @@ export class StaticAnalyzer {
         }
 
         const engine = defaultRegistry().get(engineName);
-        if (!engine) return;
+        if (!engine) {
+          // No registered engine owns this tag — the expression would go
+          // entirely unanalyzed. Surface it rather than skipping silently.
+          diagnostics.push({
+            severity: DiagnosticSeverity.Error,
+            code: "UNKNOWN_ENGINE",
+            source: SOURCE,
+            message: `${m.kind}/${resource.name}: no templating engine registered for '!${engineName}' at '${path}'.`,
+            data: { resource, filePath, path },
+          });
+          return;
+        }
         const findings = engine.analyze(expr, { celEnv: this.celEnv, contextSchema: effectiveContext });
         for (const f of findings) {
           if (f.code === "CEL_SYNTAX_ERROR") {

package/src/definition-registry.ts

@@ -119,7 +119,10 @@ export class DefinitionRegistry {
   }
 
   /** Validates data against a schema using this registry's AJV instance, which has all
-   *  registered definition schemas loaded — enabling cross-module $ref resolution. */
+   *  registered definition schemas loaded — enabling cross-module $ref resolution.
+   *  A compile failure returns `[]` here; it is surfaced loudly (once, on the
+   *  owning definition) by `schemaCompileError` via the analyzer's
+   *  definition-schema compile check, so resources are never silently skipped. */
   validateWithRefs(data: unknown, schema: Record<string, any>): string[] {
     let validate: ReturnType<typeof this.ajv.compile>;
     try {
@@ -131,6 +134,22 @@ export class DefinitionRegistry {
     return (validate.errors ?? []).map(formatSingleError);
   }
 
+  /** Returns the AJV compile error for `schema`, or `undefined` when it compiles.
+   *  Compiles on this registry's instance, which has every loaded module schema
+   *  plus the manifest root registered, so local `#/$defs`, `telo://manifest`,
+   *  and cross-module `$ref`s all resolve. Used to fail loud on a definition
+   *  schema that AJV cannot compile — otherwise `validateAgainstSchema` /
+   *  `validateWithRefs` would swallow the failure and silently skip every
+   *  resource of that kind. */
+  schemaCompileError(schema: Record<string, any>): string | undefined {
+    try {
+      this.ajv.compile(schema);
+      return undefined;
+    } catch (err) {
+      return err instanceof Error ? err.message : String(err);
+    }
+  }
+
   private tryRegisterSchema(
     moduleName: string,
     typeName: string,

package/src/reference-field-map.ts

@@ -148,7 +148,7 @@ export function buildReferenceFieldMap(schema: Record<string, any>): ReferenceFi
   return map;
 }
 
-function collectRefs(node: Record<string, any>): string[] {
+export function collectRefs(node: Record<string, any>): string[] {
   const refs: string[] = [];
   if (typeof node["x-telo-ref"] === "string") {
     refs.push(node["x-telo-ref"]);

package/src/schema-compat.ts

@@ -146,6 +146,10 @@ export function validateAgainstSchema(data: unknown, schema: Record<string, any>
       validate = ajv.compile(schema);
       compiledSchemaValidators.set(schema, validate);
     } catch {
+      // A schema that won't compile is reported loudly (once, on the owning
+      // definition) by the analyzer's definition-schema compile check
+      // (`DefinitionRegistry.schemaCompileError`), so returning `[]` here does
+      // not silently accept resources of that kind.
       return [];
     }
   }
@@ -273,7 +277,7 @@ export function celPlaceholderForSchema(schema: Record<string, any>): unknown {
 const CEL_PURE_RE = /^\s*\$\{\{[^}]*\}\}\s*$/;
 
 /** Resolve a `$ref` (only `#/$defs/...` form) against the root schema. */
-function resolveRef(schema: Record<string, any>, root: Record<string, any>): Record<string, any> {
+export function resolveRef(schema: Record<string, any>, root: Record<string, any>): Record<string, any> {
   if (schema.$ref && typeof schema.$ref === "string" && schema.$ref.startsWith("#/$defs/")) {
     const defName = schema.$ref.slice("#/$defs/".length);
     const resolved = root.$defs?.[defName];
@@ -283,7 +287,7 @@ function resolveRef(schema: Record<string, any>, root: Record<string, any>): Rec
 }
 
 /** Collect property schemas from top-level `properties` and all `oneOf`/`anyOf` sub-schemas. */
-function collectProperties(schema: Record<string, any>): Record<string, any> {
+export function collectProperties(schema: Record<string, any>): Record<string, any> {
   const props: Record<string, any> = { ...(schema.properties ?? {}) };
   for (const sub of schema.oneOf ?? schema.anyOf ?? []) {
     if (sub && typeof sub === "object" && sub.properties) {

package/src/validate-nested-inline.ts

@@ -0,0 +1,158 @@
+import type { ResourceManifest } from "@telorun/sdk";
+import { collectRefs, isInlineResource } from "./reference-field-map.js";
+import {
+  collectProperties,
+  resolveRef,
+  substituteCelFields,
+  validateAgainstSchema,
+} from "./schema-compat.js";
+import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
+
+const SOURCE = "telo-analyzer";
+
+/** Minimal view of a definition needed to validate an inline resource's config. */
+export interface InlineDefinitionLookup {
+  (kind: string): { schema?: Record<string, any> } | undefined;
+}
+
+/**
+ * Validates inline resources nested inside a resource body against their kind's
+ * config schema. The per-resource walk in `analyze()` validates a resource's
+ * own top-level config; inline resources at `x-telo-ref` slots reachable only
+ * through a local `$ref` (notably `Run.Sequence`'s `steps[].invoke`, hidden
+ * behind `#/$defs/step`) never reach the reference field map, so they would
+ * otherwise escape schema validation — e.g. `invoke: { kind: Console.ReadLine,
+ * prompt: "…" }`, where `prompt` belongs in the step's `inputs`, not the config.
+ *
+ * Walks the manifest data together with its definition schema, resolving local
+ * `$ref`s (so step trees of arbitrary depth are covered). At each `x-telo-ref`
+ * slot holding an inline resource, the inline's config is validated against its
+ * own kind's schema, then recursed into so inline resources nested inside
+ * inline resources are covered.
+ *
+ * Non-mutating: reads `manifest` and emits diagnostics anchored to its identity
+ * and a concrete dotted path matching the position-index key format;
+ * `rewriteSyntheticOrigins` reroutes those on inline-extracted (synthetic)
+ * manifests back to the root doc.
+ */
+export function validateNestedInlineResources(
+  manifest: ResourceManifest,
+  rootSchema: Record<string, any>,
+  lookupDefinition: InlineDefinitionLookup,
+): AnalysisDiagnostic[] {
+  const diagnostics: AnalysisDiagnostic[] = [];
+  const resource = { kind: manifest.kind, name: manifest.metadata?.name as string };
+  const filePath = (manifest.metadata as { source?: string } | undefined)?.source;
+
+  function validateInline(inline: Record<string, any>, path: string): void {
+    const kind = inline.kind as string;
+    const def = lookupDefinition(kind);
+    // Unknown kind: these `$ref`-hidden slots are invisible to the field-map
+    // driven reference checks too, so nothing else would flag it — report here.
+    if (!def) {
+      diagnostics.push({
+        severity: DiagnosticSeverity.Error,
+        code: "UNDEFINED_KIND",
+        source: SOURCE,
+        message: `${resource.kind}/${resource.name}: inline ${kind} at '${path}': No Telo.Definition found for kind '${kind}'.`,
+        data: { resource, filePath, path: `${path}.kind` },
+      });
+      return;
+    }
+    // Kind exists but declares no config schema (e.g. a pure Telo.Type): no
+    // config to validate and no schema-declared slots to nest resources in.
+    if (!def.schema) return;
+    const schema = def.schema;
+    // `kind` / `metadata` are implicit on every resource; inject them so a
+    // strict `additionalProperties: false` config schema doesn't reject them.
+    const effectiveSchema =
+      schema.additionalProperties === false
+        ? {
+            ...schema,
+            properties: {
+              kind: { type: "string" },
+              metadata: { type: "object" },
+              ...schema.properties,
+            },
+          }
+        : schema;
+    // Inline resources omit `metadata` — it is synthesized when the kernel
+    // registers them (and by `normalizeInlineResources` for extracted slots,
+    // which assigns a derived `metadata.name`). Config schemas conventionally
+    // declare `required: ["metadata", …]` with `metadata.name` required, so add
+    // a placeholder before validating to mirror the post-registration shape.
+    const existingMeta =
+      inline.metadata && typeof inline.metadata === "object"
+        ? (inline.metadata as Record<string, unknown>)
+        : {};
+    const data = { ...inline, metadata: { name: "__inline__", ...existingMeta } };
+    const substituted = substituteCelFields(data, effectiveSchema, effectiveSchema);
+    for (const issue of validateAgainstSchema(substituted, effectiveSchema)) {
+      diagnostics.push({
+        severity: DiagnosticSeverity.Error,
+        code: "SCHEMA_VIOLATION",
+        source: SOURCE,
+        message: `${resource.kind}/${resource.name}: inline ${kind} at '${path}': ${issue.message}`,
+        data: { resource, filePath, path: issue.path ? `${path}.${issue.path}` : path },
+      });
+    }
+    // Recurse into the inline body against its own schema so deeper inline
+    // resources (e.g. an inline Run.Sequence's own steps) are validated too.
+    walk(inline, schema, schema, path);
+  }
+
+  function walk(
+    data: unknown,
+    schema: Record<string, any> | undefined,
+    schemaRoot: Record<string, any>,
+    path: string,
+  ): void {
+    if (!schema || typeof schema !== "object") return;
+    const resolved = resolveRef(schema, schemaRoot);
+
+    // Reference slot: the value is either a named reference (`{kind, name}`,
+    // validated as its own manifest) or an inline resource to validate here.
+    if (collectRefs(resolved).length > 0) {
+      if (
+        data &&
+        typeof data === "object" &&
+        !Array.isArray(data) &&
+        isInlineResource(data as Record<string, unknown>)
+      ) {
+        validateInline(data as Record<string, any>, path);
+      }
+      return;
+    }
+
+    if (Array.isArray(data)) {
+      const itemSchema = resolved.items as Record<string, any> | undefined;
+      if (!itemSchema) return;
+      for (let i = 0; i < data.length; i++) {
+        walk(data[i], itemSchema, schemaRoot, `${path}[${i}]`);
+      }
+      return;
+    }
+
+    if (data && typeof data === "object") {
+      const props = collectProperties(resolved);
+      const additional =
+        resolved.additionalProperties &&
+        typeof resolved.additionalProperties === "object" &&
+        !Array.isArray(resolved.additionalProperties)
+          ? (resolved.additionalProperties as Record<string, any>)
+          : undefined;
+      // Descend only where the schema declares structure. Freeform fields
+      // (`additionalProperties: true`, e.g. step `inputs`) carry caller data
+      // that may coincidentally look like `{kind: …}`; not descending there
+      // keeps the inline-resource detection anchored to real ref slots.
+      for (const [key, value] of Object.entries(data as Record<string, unknown>)) {
+        const propSchema = props[key] ?? additional;
+        if (!propSchema) continue;
+        walk(value, propSchema as Record<string, any>, schemaRoot, path ? `${path}.${key}` : key);
+      }
+    }
+  }
+
+  walk(manifest, rootSchema, rootSchema, "");
+  return diagnostics;
+}

package/dist/adapters/http-adapter.d.ts

@@ -1,10 +0,0 @@
-import { type ManifestAdapter } from "../types.js";
-export declare class HttpAdapter implements ManifestAdapter {
-    supports(url: string): boolean;
-    read(url: string): Promise<{
-        text: string;
-        source: string;
-    }>;
-    resolveRelative(base: string, relative: string): string;
-}
-//# sourceMappingURL=http-adapter.d.ts.map

package/dist/adapters/http-adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"http-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/http-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9E,qBAAa,WAAY,YAAW,eAAe;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAIxD"}

package/dist/adapters/http-adapter.js

@@ -1,18 +0,0 @@
-import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
-export class HttpAdapter {
-    supports(url) {
-        return url.startsWith("http://") || url.startsWith("https://");
-    }
-    async read(url) {
-        const fetchUrl = url.includes(".yaml") ? url : `${url}/${DEFAULT_MANIFEST_FILENAME}`;
-        const response = await fetch(fetchUrl);
-        if (!response.ok) {
-            throw new Error(`Failed to fetch manifest from ${fetchUrl}: ${response.status} ${response.statusText}`);
-        }
-        return { text: await response.text(), source: fetchUrl };
-    }
-    resolveRelative(base, relative) {
-        const baseDir = base.endsWith("/") ? base : base.slice(0, base.lastIndexOf("/") + 1);
-        return new URL(relative, baseDir).href;
-    }
-}

package/dist/adapters/node-adapter.d.ts

@@ -1,17 +0,0 @@
-import { type ManifestAdapter } from "../types.js";
-/** Node.js fs-based ManifestAdapter for local files. Not browser-compatible. */
-export declare class NodeAdapter implements ManifestAdapter {
-    private readonly cwd;
-    constructor(cwd?: string);
-    supports(url: string): boolean;
-    read(url: string): Promise<{
-        text: string;
-        source: string;
-    }>;
-    resolveRelative(base: string, relative: string): string;
-    expandGlob(base: string, patterns: string[]): Promise<string[]>;
-    resolveOwnerOf(fileUrl: string): Promise<string | null>;
-}
-/** @deprecated Use `new NodeAdapter(cwd)` instead */
-export declare function createNodeAdapter(cwd?: string): ManifestAdapter;
-//# sourceMappingURL=node-adapter.d.ts.map

package/dist/adapters/node-adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"node-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/node-adapter.ts"],"names":[],"mappings":"AAIA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAM9E,gFAAgF;AAChF,qBAAa,WAAY,YAAW,eAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,GAAE,MAAsB;IAExD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAUxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IASlE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAKjD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAc/D,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAoB9D;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAsB,GAAG,eAAe,CAE9E"}

package/dist/adapters/node-adapter.js

@@ -1,71 +0,0 @@
-import * as fs from "fs/promises";
-import * as path from "path";
-import { fileURLToPath } from "url";
-import { minimatch } from "minimatch";
-import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
-function toFilePath(url) {
-    return url.startsWith("file://") ? fileURLToPath(url) : url;
-}
-/** Node.js fs-based ManifestAdapter for local files. Not browser-compatible. */
-export class NodeAdapter {
-    cwd;
-    constructor(cwd = process.cwd()) {
-        this.cwd = cwd;
-    }
-    supports(url) {
-        return (url.startsWith("file://") ||
-            url.startsWith("/") ||
-            url.startsWith("./") ||
-            url.startsWith("../") ||
-            (!url.includes("://") && !url.includes("@")));
-    }
-    async read(url) {
-        const filePath = toFilePath(url);
-        const stat = await fs.stat(filePath).catch(() => null);
-        const resolvedPath = stat?.isDirectory() ? path.join(filePath, DEFAULT_MANIFEST_FILENAME) : filePath;
-        const text = await fs.readFile(resolvedPath, "utf8");
-        return { text, source: resolvedPath };
-    }
-    resolveRelative(base, relative) {
-        const baseDir = path.dirname(path.resolve(this.cwd, toFilePath(base)));
-        return path.resolve(baseDir, relative);
-    }
-    async expandGlob(base, patterns) {
-        const baseDir = path.dirname(path.resolve(this.cwd, toFilePath(base)));
-        const entries = await fs.readdir(baseDir, { recursive: true, encoding: "utf8" });
-        const normalizedPatterns = patterns.map((p) => p.replace(/\\/g, "/").replace(/^\.\//, ""));
-        const matched = [];
-        for (const entry of entries) {
-            const normalized = entry.replace(/\\/g, "/");
-            if (normalizedPatterns.some((p) => minimatch(normalized, p))) {
-                matched.push(path.resolve(baseDir, entry));
-            }
-        }
-        return matched.sort();
-    }
-    async resolveOwnerOf(fileUrl) {
-        const resolved = path.resolve(this.cwd, toFilePath(fileUrl));
-        let dir = path.dirname(resolved);
-        while (true) {
-            const candidate = path.join(dir, DEFAULT_MANIFEST_FILENAME);
-            if (candidate !== resolved) {
-                try {
-                    await fs.access(candidate);
-                    return candidate;
-                }
-                catch {
-                    // telo.yaml not found at this level
-                }
-            }
-            const parent = path.dirname(dir);
-            if (parent === dir)
-                break;
-            dir = parent;
-        }
-        return null;
-    }
-}
-/** @deprecated Use `new NodeAdapter(cwd)` instead */
-export function createNodeAdapter(cwd = process.cwd()) {
-    return new NodeAdapter(cwd);
-}

package/dist/adapters/registry-adapter.d.ts

@@ -1,15 +0,0 @@
-import { type ManifestAdapter } from "../types.js";
-export declare class RegistryAdapter implements ManifestAdapter {
-    private registryUrl;
-    constructor(registryUrl?: string);
-    supports(url: string): boolean;
-    read(moduleRef: string): Promise<{
-        text: string;
-        source: string;
-    }>;
-    resolveRelative(base: string, relative: string): string;
-    private toRegistryModuleBase;
-    private toRegistryUrl;
-    private parseModuleRef;
-}
-//# sourceMappingURL=registry-adapter.d.ts.map

package/dist/adapters/registry-adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/registry-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAI9E,qBAAa,eAAgB,YAAW,eAAe;IACzC,OAAO,CAAC,WAAW;gBAAX,WAAW,SAAuB;IAEtD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAWxB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAWxE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAMvD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,cAAc;CAmBvB"}

package/dist/adapters/registry-adapter.js

@@ -1,53 +0,0 @@
-import { DEFAULT_MANIFEST_FILENAME } from "../types.js";
-const DEFAULT_REGISTRY_URL = "https://registry.telo.run";
-export class RegistryAdapter {
-    registryUrl;
-    constructor(registryUrl = DEFAULT_REGISTRY_URL) {
-        this.registryUrl = registryUrl;
-    }
-    supports(url) {
-        return (!url.startsWith("http://") &&
-            !url.startsWith("https://") &&
-            !url.startsWith("/") &&
-            !url.startsWith(".") &&
-            url.includes("@") &&
-            url.includes("/"));
-    }
-    async read(moduleRef) {
-        const fetchUrl = this.toRegistryUrl(moduleRef);
-        const response = await fetch(fetchUrl);
-        if (!response.ok) {
-            throw new Error(`Failed to fetch manifest ${moduleRef}: ${response.status} ${response.statusText}`);
-        }
-        return { text: await response.text(), source: fetchUrl };
-    }
-    resolveRelative(base, relative) {
-        const baseUrl = this.supports(base) ? this.toRegistryModuleBase(base) : base;
-        const baseWithSlash = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
-        return new URL(relative, baseWithSlash).href;
-    }
-    toRegistryModuleBase(moduleRef) {
-        const parsed = this.parseModuleRef(moduleRef);
-        const normalizedBase = this.registryUrl.replace(/\/+$/, "");
-        return `${normalizedBase}/${parsed.modulePath}/${parsed.version}`;
-    }
-    toRegistryUrl(moduleRef) {
-        return `${this.toRegistryModuleBase(moduleRef)}/${DEFAULT_MANIFEST_FILENAME}`;
-    }
-    parseModuleRef(moduleRef) {
-        const atIdx = moduleRef.lastIndexOf("@");
-        if (atIdx <= 0 || atIdx === moduleRef.length - 1) {
-            throw new Error(`Invalid module reference '${moduleRef}', expected namespace/name@version`);
-        }
-        const modulePath = moduleRef.slice(0, atIdx);
-        if (!modulePath.includes("/")) {
-            throw new Error(`Invalid module reference '${moduleRef}', expected namespace/name@version`);
-        }
-        const rawVersion = moduleRef.slice(atIdx + 1);
-        const version = rawVersion.startsWith("v") ? rawVersion.substring(1) : rawVersion;
-        if (!version) {
-            throw new Error(`Invalid module reference '${moduleRef}', expected namespace/name@version`);
-        }
-        return { modulePath, version };
-    }
-}